<html>
<body>
<?php
session_start(); // Create the session, Ready for our login data.
$username = addslashes($_POST['username']); // Gets the username from the login.php page.
$password = addslashes($_POST['password']); // Gets the plain text password.
$database = "cmict_test";
// Connect to your database
mysql_connect("","","") or die(mysql_error());
mysql_select_db("$database");
$query = "SELECT * FROM users WHERE username = '$username' and password = '$password' LIMIT 1";
$username = mysql_real_escape_string($username); // just to be sure.
$result = mysql_query($query) or die(mysql_error());
while($row = mysql_fetch_array($result)){
$resusername = $row['username']; // username from DB
$respassword = $row['password']; // password from DB
$resemail = $row['email']; // email from db
$admin = $row['positief'];
}
// Are they a valid user?
if ($resusername == $username && $respassword == $password) {
// Yes they are.
// Lets put some data in our session vars and mark them as logged in.
$_SESSION['loggedin'] = "1";
$_SESSION['email'] = $resemail;
$_SESSION['username'] = $resusername;
$_SESSION['logadmin'] = $admin;
header("location:navigra.php");
}else{
// No, Lets mark them as invalid.
$_SESSION['loggedin'] = "0";
echo "Sorry, Invalid details.<br>";
die ('klik <a href="testlogin.php">hier</a> om opnieuw te proberen.');
}
?>
</body>
</html>
EDIT :
-added check on username in sql query (as suggested by Jason)
-added addslashes for basic protection against SQL injection.